# vim: filetype=yaml sw=2
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
version: 7.3.0
var:
  container:
    use_container: 1
  deps:
    - build-essential
    - libmpc-dev
  setup: |
    [% c("var/setarch") -%]
    mkdir -p /var/tmp/dist
    tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %]
    export PATH="/var/tmp/dist/gcc/bin:$PATH"
    [% IF c("var/osname") == "linux-i686" || c("var/osname") == "linux-armv7" -%]
    export LD_LIBRARY_PATH=/var/tmp/dist/gcc/lib
    [% ELSE -%]
    export LD_LIBRARY_PATH=/var/tmp/dist/gcc/lib64
    [% END -%]

    [% IF c("hardened_gcc") -%]
      # Config options for hardening-wrapper
      export DEB_BUILD_HARDENING=1
      export DEB_BUILD_HARDENING_STACKPROTECTOR=1
      export DEB_BUILD_HARDENING_FORTIFY=1
      export DEB_BUILD_HARDENING_FORMAT=1
      export DEB_BUILD_HARDENING_PIE=1

      # Make sure we use the hardening wrapper
      pushd /var/tmp/dist/gcc/bin
      cp /usr/bin/hardened-cc ./
      mv gcc gcc.real
      mv c++ c++.real
      mv g++ g++.real
      ln -sf hardened-cc gcc
      ln -sf hardened-cc c++
      ln -sf hardened-cc g++
      popd
    [% ELSIF c("hardened_gcc_next") -%]
      # Config options for dpkg-buildflags, see man(1) dpkg-buildflags
      # and https://wiki.debian.org/Hardening#Using_Hardening_Options
      # `+all` currently expands to
      # `+format,+fortify,+stackprotectorstrong,+relro,+bindnow,+pie`
      export DEB_BUILD_OPTIONS=hardening=+all
    [% END -%]

targets:
  windows:
    var:
      configure_opt: --disable-multilib --enable-languages=c,c++
      arch_deps:
        - libc6-dev
        - zlib1g-dev
  linux:
    hardened_gcc: 1
  linux-next:
    hardened_gcc_next: 1
  linux-i686:
    var:
      configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib
      arch_deps:
        - hardening-wrapper
        - libc6-dev
        - zlib1g-dev
  linux-x86_64:
    var:
      configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686
      arch_deps:
        - hardening-wrapper
        - libc6-dev-i386
  linux-aarch64:
    var:
      configure_opt: --enable-multilib --enable-languages=c,c++
      arch_deps:
        - libc6-dev
  linux-armv7:
    var:
      configure_opt: --enable-multilib --enable-languages=c,c++
      arch_deps:
        - libc6-dev

input_files:
  - project: container-image
  - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.xz'
    sha256sum: 832ca6ae04636adbb430e865a1451adf6979ab44ca1c8374f61fba65645ce15c

#CFLAGS="${CFLAGS} -fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -Wformat=2 -Wformat-security -Wl,-pie,-z,relro,-z,now" CXXFLAGS="${CXXFLAGS} -fstack-protector-strong -fPIE -D_FORTIFY_SOURCE=2 -Wformat=2 -Wformat-security -Wl,-pie,-z,relro,-z,now" LDFLAGS="${LDFLAGS} -pie -z,relro -z,now"

